An attacker's minimally-audible perturbed call clip fools a routing classifier in one replay of five - how do you triage that finding?

## Why a minimal result is fragile by construction A search that minimises the size of the change stops the moment the model's answer flips. That is the whole point of the formulation - it is asking for the cheapest flip, not a comfortable one. The consequence is that the resulting item sits essentially **on** the decision surface, with no reserve. Nothing was spent on making the flip survive anything. Now put that item through a real delivery path. A recorded call is resampled, passed through a lossy codec, possibly played and re-captured through a room and a microphone, subjected to automatic gain, and arrives at the model from a handset with different frequency response from the one the search assumed. Each of those transformations moves the item, and typically moves it by more than the perturbation itself did. Roughly speaking, the channel's own noise floor exceeds the attack's amplitude, so the item lands back on the correct side of the boundary most of the time. One replay in five getting through is exactly the behaviour this formulation predicts. The mistake in triage is to read the intermittency as test flakiness or as evidence that the finding is not real. It is neither. It is a measurement of how much margin the attack had, which was none. ## Splitting the finding The useful move is to separate the two claims that are tangled together in the report. **Claim one: the model has inputs close to a boundary.** This is established, deterministically, against the weight file. It is a real property of the model and it belongs in the report as such. It also says something about the exposure created by shipping weights onto an appliance at all - an adversary who has the file searches for free, and free search is what makes minimisation affordable. **Claim two: the deployed system can be evaded through the delivery path.** This is not established by a result that survives one attempt in five. What the evidence supports is a probability, not a capability, and the difference matters to whoever has to decide what this finding is worth. ## What would settle claim two An attack that must survive a channel has to be built against that channel's variability from the outset rather than optimised in a clean digital setting and then played through it - and the same is true of demanding a flip that holds with room to spare rather than barely. Both are the same trade: you give up minimality to buy margin. The interesting consequence is that the change gets **larger**, and the moment it gets larger it starts running into the constraint that actually binds in this pipeline. Because the call is not only classified; a person also reviews flagged and routed items. The attacker's real requirement is that the model routes the clip the way they want **and** the human hears nothing worth escalating. The win is that nobody looks. So the honest way to state the question after triage is: does the perturbation that survives the channel stay under what the reviewer would notice? If yes, this is a serious finding about the deployed system. If no, the attack fails its own constraint, and that is itself a useful result to write down - it says the human in the loop, not the model, is what is holding the line, which is a fragile place for the line to be. ## Reporting it honestly A finding like this is easy to overstate in either direction, and both directions are reputational risks for a red team. - Do not report it as a compromise of the deployed system. One in five through a specific capture path is not a capability claim. - Do not discard it as noise. It is a confirmed property of the model and a confirmed exposure of the weight file. - State the reproduction rate and the exact channel it was measured over - sample rate, coding, whether it was replayed acoustically or injected digitally, which handset. Those details are the finding; without them the number means nothing and cannot be re-measured by anyone else. - Say explicitly which formulation produced the item, because a reader who knows it was a minimising search already knows why the margin is zero, and a reader who does not will misread the intermittency as sloppiness. ## The general lesson Minimality and durability are opposed. The smallest change that flips a model is, by definition, the one least able to survive anything happening to it afterwards. Any attack that has to cross a real channel is paying for margin somewhere, and the currency is size - which is also the currency that gets it noticed. Anybody reasoning about evasion in a physical or transmitted setting has to hold both ends of that trade at once, and a purely digital minimal result is a lower bound on the attacker's difficulty, never a demonstration of the deployed risk.